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Abstract 

In December of 2005, one of two trailing umbilical cables used on the International Space Station (ISS) 
Mobile Transporter (MT) was inadvertently severed by an internal cutter system designed to free a 
snagged cable or jammed reel while transporting hazardous payloads. The mechanism’s intended means 
of actuation is electrical; however, troubleshooting revealed a mechanical actuation occurred. The 
investigation of the failed component revealed several lessons learned in developing hardware 
requirements, understanding and following the rationale behind the requirements throughout the design 
life cycle, understanding the impacts of gaps and tolerances in a mechanism, and the importance of 
identifying critical steps during assembly. 


Introduction 

On December 16, 2005, a power switch on the ISS was tripped by a short circuit. Video of the MT and 
Trailing Umbilical System (TUS) cable revealed the cable routed to Interface Umbilical Assembly (IUA) 2 
on the nadir side of the MT had been inadvertently severed (see Figure 1). When the cable was severed 
the live wire tips contacted metal causing a short, leading to a tripped power switch. Commanded 
actuation requires three independent power switch closures to the TUS Disconnect Actuator (TDA), and 
telemetry analysis indicated no possible electrical cause. The only remaining cause of the severed cable 
was a mechanical failure of the TDA. 

A team was formed to evaluate the failure, understand the impact of operating the MT with a single TUS 
cable in the near term, and implement the recovery plan based on an extensive failure investigation. This 
paper will describe the high level system, the lower level mechanism design and failure, the design and 
assembly errors, along with the implemented changes, and current operating configuration. As the 
investigation proceeded, it was clear that not only did the mechanism fail, but that the need for the 
mechanism was outdated for the current ISS requirements. 



Figure 1. Severed TUS Cable on IUA 2 


NASA, Johnson Space Center, Houston, Texas 

** Boeing, Houston, Texas 

Proceedings of the 39 th Aerospace Mechanisms Symposium, NASA Marshall Space Flight Center, May 7-9, 2008 


1 


Hardware Description 


System Description 

The ISS MT moves along the Integrated Truss Segment rail, and in conjunction with the Mobile Base 
System (MBS) and Space Station Remote Manipulator System (SSRMS), are used to transport payloads. 
When the MT is latched down at a worksite, the Umbilical Mating Assembly (UMA) provides the 
necessary power to the MBS and SSRMS. The MBS, SSRMS, and other payloads will now be generically 
referred to as the MT payloads. The TUS cable provides both power and data at any point along the truss 
to the MT, but only data and video to payloads. Therefore, the MT payloads do not receive power 
between MT worksites. The capability to remotely free a stranded MT can be critical to the survivability of 
the payload and also provides a way to prevent a catastrophic hazard. 

The TUS consists of two parallel cables, one on each side of the MT. Each cable in this redundant 
system is on a retractable reel stored within the SO truss segment (see Figure 2). The Interface Umbilical 
Assembly (IUA) is the interaction point between the MT and the TUS. The MT also has two lUAs, one for 
each TUS cable. Contained within the IUA is the TDA which allows the crew or ground to remotely sever 
the TUS cable and free the MT in the case of a TUS reel jam or failure during translation. The ability to 
remotely cut the TUS cable was a feature added early in the ISS Program to prevent catastrophic 
hazards due to moving hazardous materials along the truss rails. 
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TDA Mechanism 


The TDA is a low shock, fast acting guillotine cable cutting mechanism. A cross section is shown in Figure 
3, omitting the Release Plunger Compression Springs and the Restraining Wire that is wrapped around 
the Split Spool 15 times. The Primary Compression Springs load the T-plunger, which drives the blade 
that cuts the TUS cable (not shown). There is a compression spring under the Release Plunger, which 
pushes the Actuator Plunger into the Split Spool. The two halves of the Split Spool are held together with 
a Restraining Wire and connected to a fuse wire at the end (not shown). The fuse wire holds the 
restraining wire in place. 



FULL 

ACTUATION 



Figure 3. Actuation of the TUS Disconnect Actuator 


TDA Actuation 

To actuate the mechanism, current is passed through the fuse wire, causing it to weaken and break under 
load. The Restraining Wire is then free to uncoil; thus it quickly unwinds from the Split Spool (see Figure 
4). With the Restraining Wire out of the load path, the spring under the Release Plunger pushes the 
Actuator Plunger, splitting the two halves of the Split Spool apart as the Actuator Plunger moves upwards. 
With the Release Plunger clear, the Retaining Pins are forced outward by the T-plunger. Without the 
Retaining Pins in the load path, the Primary Compression Springs are able to release their stored energy, 
pushing the T-plunger through the assembly, and driving the cutting blade into the TUS cable. See the 
actuation sequence in Figure 3. 
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Figure 4. TDA X-Rays 
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Restraining Bolt 

The Restraining Bolt is used to prevent inadvertent actuation during launch vibration. In Figure 3, the 
crew interface is on the left side of the Restraining Bolt, and the shaft to the right of the threads blocks the 
Release Plunger if the TDA is actuated inadvertently. By design, a small gap is intended between the fully 
engaged Restraining Bolt and the Release Plunger. This ensures that the Split Spool locks the 
mechanism and the Restraining Bolt is truly a redundant feature. During initial on-orbit activation, the 
Restraining Bolt is removed, which arms the TDA. The “Fully Locked” view of Figure 3 shows the TDA 
armed with the Restraining Bolt backed out from the launch position. 

Failure Investigation 

The first indication of the TDA failure was the tripping of a power switch. Telemetry analysis found no 
electrical faults, indicating a mechanical failure was the likely cause. Subsequent video review confirmed 
the cable was cleanly cut, and the full TDA actuation sequence had occurred. The remaining TDA 
mechanism failure modes were: Structural failure of the Restraining Wire, Split Spool, or T-plunger; 
tolerance stack-up effects; assembly or process errors; and orbital debris impact. 

Structural Failure 

Structural failure modes that were identified as a possible cause were compression yielding or creep of 
the Split Spool material (Torlon), fatigue or creep failure of the Restraining Wire, or yielding of the T- 
plunger assembly components. Failure due to fatigue or creep of the Restraining Wire was considered 
low likelihood because the load on the wire is constant with small magnitude thermal cycle loads that are 
evenly distributed. Fracture of the T-plunger was ruled out due to large cross sectional area and adequate 
strength margins for a nominal design. Under nominal design loading conditions the Torlon Split Spool 
also has adequate strength margins. 

Design and Tolerance Assessment 

An assessment of the design was performed to determine what effects the as-built hardware could have 
on the position of the components within the mechanism. The results of the assessment indicated that 
when the components were built to the nominal drawing dimensions a gap would exist between the 
Actuator Plunger and Split Spool. If the as-built components were biased to one side this could increase 
that gap. The TDA assembly drawing omits this gap (see Figure 5). 

During assembly of the flight units, the top portion of the T-plunger is installed and the Release Plunger 
with Retaining Pins is compressed. Next, the Restraining Bolt is engaged to hold the Release Plunger in 
place and preclude release of the top portion of the T-plunger. The Primary Compression Springs are 
then mechanically compressed, and the bottom portion of the T-plunger is installed and fastened to the 
top portion with a single bolt. The final step installs the TDA Cover with Split Spool to the Housing. After 
reviewing the assembly process it was clear that any gap between the Actuator Plunger and Split Spool 
would go undetected during final assembly of the flight unit. That gap is maintained by the Restraining 
Bolt until the unit is activated on-orbit. During on-orbit activation the Restraining Bolt is removed and the 
Release Plunger would move to close the gap (see Figure 5). 
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Modified TDA Assembly Drawing 

(Modified to show gap) 


Restraining Release 



TDA CAD Model Partially Actuated 

(Restraining Bolt released, Release 
Plunger shifted, gap closed) 


Figure 5. Gap Illustrations 

This movement was confirmed on-orbit when the Restraining Bolt required higher than expected torque 
during removal due to the load being applied to the bolt from the Release Plunger. This was seen again 
when the Restraining Bolt would not re-engage during failure troubleshooting years later, since the 
Release Plunger had shifted and created interference. When the gap is closed, the TDA is placed into a 
partially actuated state which changes the load path within the mechanism. After the failed TDA was 
returned to the ground a CAD model was created using the as-flown component dimensions. This model 
further illustrated the gap and clearly showed a discrepancy in the design assembly drawing. 

Ground Investigation 

Upon return of the failed TDA, disassembly and non-destructive evaluations were performed. The first 
was an x-ray of the TDA Housing and internal components to determine whether or not the Restraining 
Wire and Fuse Wire were still intact. In addition, a detailed survey was performed of the exterior of the 
TDA Housing and Cover. Since the TDA mechanism was actuated and disassembled from the IUA on- 
orbit, the T-plunger and spring dimensions and surfaces could also be inspected. The x-ray of the TDA 
Housing clearly showed the Restraining Wire and Fuse Wire were still intact and did not cause the failure. 
When the outer covering tape was removed from the top portion of the TDA Cover, a non-uniform gap 
nearly 1.02 mm (0.04 in) tall was found between the Cover and Housing, indicating an assembly error. 
This gap was also confirmed by a subsequent review of the x-ray. The markings on the removed tape 
were consistent with a gap that had been present from initial Cover installation. 



Figure 6. Failed TDA External View (tape removed) & X-Ray 
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Upon inspection of the T-plunger, yielding was found where it contacted the Retaining Pins. Prior to 
obtaining the failed TDA, a series of ground tests were performed to support the planned on-orbit repair 
strategy. These tests included both a slow mechanical release of the Actuator Plunger and a near 
instantaneous release of the Actuator Plunger. Mechanical actuation was achieved by slowly backing out 
the fasteners that hold the Cover and Split Spool to the Housing, thus allowing the Release Plunger to 
shift and release the T-plunger. This test resulted in three findings that were significant to the failure 
investigation: 1) The T-plunger release required significantly less travel than expected (-0.965 mm (0.038 
in) actual vs. -4.75 mm (0.187 in) expected), 2) The edge of the T-plunger notch was mechanically 
yielded at the Release Pin interface, 3) The Split Spool was damaged at the Actuator Plunger interface. 
Post flight inspection of the failed TDA T-plunger indicated similar notch yielding at the Retaining Pin 
interface. The travel required to mechanically actuate the TDA was similar to the gap that was seen 
between the Cover and the Housing on the failed TDA. This indicates the TDA was very close to 
actuating when the Restraining Bolt was first removed on-orbit. 



Figure 7. T-Plungers Post Actuation 
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The Split Spool and Restraining Wire were inspected via x-ray and visually after initial disassembly. The 
Restraining Wire was intact and did not allow the Split Spool to separate. The Split Spool was then 
separated by removing the Restraining Wire to allow a detailed inspection of the Split Spool halves. The 
inspection revealed the Release Plunger had compressively yielded the interior of the Split Spool. This 
finding was consistent with the damage seen during the mechanically actuated ground test. This damage 
is caused by an increased force transferred to the Actuator Plunger from the Primary Compression 
Springs during a slow release actuation. As the Release Plunger travels upward the Primary 
Compression Springs force the Restraining Pins outward. This outward force is then transmitted to the 
Release Plunger and subsequently to the Split Spool. When the TDA is electrically actuated the Split 
Spool if free to separate and thus does not compressively yield (see Figure 8). 



Figure 8. Split Spool Details 

Review of our findings from the ground testing, analysis, disassembly, and inspection of the failed unit 
revealed the failure was caused by a combination of the as-built gap, the gap created during assembly, 
and overstress of the T-plunger and Split Spool. The gaps caused by design tolerances and an assembly 
error put the mechanism in a position that was near firing. This position put the T-plunger and Split Spool 
in a loading configuration that was not consistent with the validated design and exceeded their structural 
capability. 
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Implemented Repair 


The ISS Program was tasked with developing a forward plan for the lUAs on-orbit and the remaining 
spare on the ground while maintaining MT capability for continued assembly. Consideration was required 
for both controlling hazardous transportations as well as the loss of power to payloads in a stranded MT 
case. The ISS Program no longer plans to transport hazardous cargo; and therefore, determined the TDA 
and cutting capability is not presently necessary. There is still the open issue of losing critical payloads in 
the MT stranded case, but that was being addressed by the ISS Program and not a requirement that the 
repair team had to solve. 

In the weeks after the TUS 2 cable sever, the team was concerned with the possibility of a second TDA 
failure on lUA 1 leading to a TUS 1 cable sever. In early February 2006 during Russian Extravehicular 
Activity (EVA) 1 5, the TUS 1 cable was routed outside of the TDA to prevent it from being cut until a long 
term repair could be implemented. The configuration of the MT leading up to the removal of the failed 
system was the TUS 1 cable was severed (IUA 1 failed) and the TUS 2 cable was routed outside of the 
TDA. The team prepared a repair to regain full MT redundancy in one Shuttle Flight, STS-121 (ISS 
Mission ULF1.1), in July of 2006. One requirement was to fly a spare TUS Reel containing a fully intact 
cable with connectors. In addition, the blade blocker (see Figure 9) was designed and tested on the 
ground to be installed EVA onto IUA 1 to prevent the TDA from cutting the cable in the case it too 
mechanically failed. The repair allowed for IUA 1 to be fixed in place in one short EVA task. 



Blade Blocker Installed 


Cut Away Showing Bolt 1 
Engaged 


Figure 9. Blade Blocker Details 
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Next was to address both the ground spare and the failed lUA 2 on-orbit. For the ground spare the TDA 
hardware was removed to prevent inadvertent actuation once in service. The lUA itself is still required for 
power conditioning, TUS cable to MT interface connections, and cable strain relief. This modified spare 
unit was installed in place of the failed lUA 2 during the STS-121/ ISS ULF1 .1 mission. With the removal 
and replacement (R&R) of the TUS 2 Reel, installation of the blade blocker onto the lUA 1, and R&R of 
lUA 2 with the newly configured spare, the MT System was left with full redundancy at the end of the 
mission. In a subsequent decision, the ISS Mission Management Team decided the crew would 
disassemble the failed TDA on-orbit and only return that small portion to the ground for failure 
investigation. The failed lUA 2 was re-configured much like the spare unit during the mission and now 
serves as a fully operational lUA spare on-orbit without any ground re-processing required. Figure 10 
illustrates the configuration of a newly configured lUA. 



Cover Plate in 
Place of Removed 
TDA 


Figure 10. New lUA Configuration 
Lessons Learned 

During teardown of the failed unit, four opportunities for improvement were identified: The original 
requirement to remotely free a stranded MT was no longer valid, mechanism initial position could 
significantly change the load path, a critical inspection point was missed, and structural materials were 
not selected for robustness. The TDA remained in place after a major program change eliminated the risk 
it was meant to mitigate. Unfavorably stacked tolerances would create a load changing gap. Installation 
requirements checked torques, but not seating between subassemblies. Finally, a polymer was selected 
for a compressive strength application. Explanations of each issue and our recommendations for 
correction are presented as mitigation for similar problems in other mechanisms. 

Requirement Validity 

In this case, the original requirement was based on a need to mitigate an explosive hazard with a short 
time to effect. The explosive hazard was created by moving hydrazine propellant tanks onboard the MT 
for re-supply. If a system failure prevented the MT from moving the tanks, fast recovery was critical. This 
drove the design process towards selecting a remotely activated device. The fast acting Split Spool 
mechanism in the TDA responds very quickly and was a good choice for those conditions. A different use 
environment with a longer time to effect may have changed the design direction. 

Changes in requirements eliminated the need for external hydrazine tanks. When Russian derived 
propulsion systems were added, the external tanks of hydrazine were eliminated. Without the tanks, there 
was no longer an explosive hazard onboard the MT. 

Removing the major hazard from the system changes the trade study variables, especially time to effect. 
In this case, without a need for instant response, an externally activated quick disconnect or motor driven 
mechanism may have been adequate. Failures of those mechanisms would not require the expense and 
difficulty of a shuttle mission to deliver a large, new, replacement part. 
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When the propulsion change was made, the risk posed by a system failure should have been reexamined 
more thoroughly. A near instant response method was no longer necessary, and slower acting 
alternatives to the TDA could have become viable options. A detailed reexamination of requirements after 
each major design change would screen for impacts such as this. A new trade study at that point may 
have changed the requirements for disconnection greatly. A different approach, like a quick disconnect, 
could mitigate the destructive aspects of a cable disconnection and reduce the severity of an actuator 
failure to the overall system. 

Tolerances and Drawing 

Cross sections of the TDA assembly drawing show a close fit between the Split Spool and the Actuator 
Plunger and a gap between the Restraining Bolt and Release Plunger. As-built assembly indicated a gap 
at the Split Spool and a closed gap at the Restraining Bolt to Release Plunger interface, as seen in Figure 
5, leaving the TDA partially actuated and changing the load path. 

Creating a gap between the Actuator Plunger and the Split Spool allows a partial actuation of the TDA 
when the Restraining Bolt is removed. The effect of creating that gap is movement of the Retaining Pins 
along the slope of the T-plunger, as shown in Figure 10. When this loading condition is created, the high 
force from the Primary Compression Springs is concentrated on a significantly smaller area within the 
TDA. The designed line contact reduces greatly as it approaches a point contact as shown in Figure 10. 
Any yielding at that point exacerbates the problem and further actuates the TDA. 
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Actual 


T-Plunger has Moved Down 



Figure 10. Change in Load Condition at Retaining Pin 

A detailed design study and resting state review considering the impacts of spring forces would point out 
the possibility of these issues and their impact to loading within the mechanism. Defining critical 
dimensions for Split Spool and Actuator Plunger height to ensure the Restraining Pins would remain fully 
seated could prevent a gap and the associated high loading condition. 
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Mandatory Inspection Point Selection 

During disassembly of the failed TDA, a significant 1 .02 mm (0.04 in) gap was found between the Cover 
and the Housing. This additional gap exacerbated the design gap at the interface, worsened the partial 
actuation state, and increased the load concentration. 

Cover installation drawings called out a torque requirement for the bolts used to attach the Cover, but did 
not require any dimensional inspection or verification that the two parts were in solid contact. As a result, 
if the bolts reached their minimum installation torque before the parts were fully seated, a new gap could 
be created between the Split Spool and the Actuator Plunger. 

Adding a mandatory inspection of the gap between the Cover and the Housing would prevent creating a 
gap from incomplete seating between the parts. Required inspection for both fastener torque and seating 
should be considered whenever an interface is critical to the load path of your mechanism. 

Heritage Design 

Disassembly of the Cover portion of the TDA assembly revealed deformation and yielding of the Split 
Spool (see Figure 11). Torlon Split Spools of this type had been used previously in switches for power 
systems. 



Figure 11. Split Spool Deformation 

In other applications, Torlon was highly desirable because of its electrical insulating properties. For the 
TDA, electrical properties were irrelevant. Structure focused requirements for this portion of the TDA 
would have weighted strength as far more important than electrical resistance. Torlon would not be as 
robust as steel for this application. Since electrical resistance was irrelevant, a steel Split Spool would be 
a more desirable choice for a compressively loaded structural member. 

Where mechanical and strength properties are the main requirement, they should be weighted more 
heavily than flight history or other concerns. If the Split Spool was never overloaded, polymer selection 
would not have been a problem. In this case, other issues led to structural members experiencing loads in 
excess of design loads and failed by yielding. Caution should be used whenever adapting heritage 
designs that were developed for other applications. 
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Conclusions 


Evidence indicates the TDA was in a partially actuated state from the moment it was activated on orbit, 
thus fundamentally changing the load within the mechanism and creating an unforeseen failure mode. 
This investigation discovered several issues that should be mitigated in future designs: 1) Ensure that the 
requirements driving your mechanism design are still valid and are properly weighted in trade studies. 2) 
Verify that the as built components of the assembly will produce a mechanism that will function as 
intended both structurally and kinematically. 3) Inspect dimensions that control the kinematics and load 
path of the mechanism, checking both torque and seating of assemblies. 4) Lastly, focus material 
selection requirements on each specific application and exercise caution when reusing heritage design. A 
TDA with these issues corrected would not experience the failure seen on-orbit. 
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